CVE-2026-50633: Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Other sources
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXF (JCA integration module)to a version that resolves this vulnerability.Fixed in 4.2.2 - Upgrade
Upgrade
Apache CXF (JCA integration module)to a version that resolves this vulnerability.Fixed in 4.1.7 - Upgrade
Upgrade
Apache CXF (JCA integration module)to a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50633?
The severity of CVE-2026-50633 is rated as high with a score of 8.1.
How do I fix CVE-2026-50633?
To fix CVE-2026-50633, users should upgrade Apache CXF to version 4.2.2 or 4.1.7.
What vulnerability exists in CVE-2026-50633?
CVE-2026-50633 contains a JNDI Injection vulnerability in the DispatchMDBMessageListenerImpl of Apache CXF.
What can an attacker achieve with CVE-2026-50633?
An attacker can achieve code execution if they manipulate the JCA deployment descriptor or runtime activation parameters.
Which software is affected by CVE-2026-50633?
CVE-2026-50633 affects the Apache CXF software.